News
Local

Class action suit in the works over pirvacy breach

A Sault Area Hospital employee has been terminated after hospital officials say patient records were accessed inappropriately.

Mario Paluzzi, vice president of SAH public relations, said the investigation began last summer after it was first discovered during a random audit that “something went wrong here.”

The investigation, which began immediately and resulted in a complete audit of the individual's access into the MediTech system, went back to 2008.

The results indicated that 144 “breaches” were discovered, Paluzzi said.

Patients, whose information was inappropriately accessed, were notified by way of a letter and with the assistance of the Information and Privacy Commissioner once the hospital completed its due diligence, Paluzzi said.

It's not believed the records were copied, downloaded or exported, he said.

“I'm not sure exactly when the records were accessed but our audit shows that there were 144 inappropriate cases of accessing patient files,” Paluzzi said. “We have zero tolerance and the repercussions are swift and significant” after proper checks and balances are completed.

The MediTech system is a common computerized system used in the health care industry.

At SAH, many staff have access to the system and patient files but employees are only supposed to access patient files if they are part of that patient's circle of care.

“We have done as much as possible to educate (our staff) and they know we have zero tolerance,” he said.

In this particular case, the employee – whom Paluzzi would not identify by name, position or area employed – had accessed about 500-600 files, of which the majority were justified access, he said.

That individual is appealing the termination notice.

Since the notification letters have gone out, Paluzzi said a number of distraught patients have called the hospital seeking more information about the types of information that was accessed, why, and how it can be used.

“We have no reason to believe the access was other than for curiosity. Someone was being nosy, a little too curious,” he said.

Paluzzi said he did not know whether health card numbers were accessed or what implications that would have on the patients who own those numbers.

“The individual was just curious. The information was not passed along, not copied and the health card numbers were not shared,” he said.

The MediTech system is used by doctors, nurses, technicians, clinical services, diagnostic imaging staff and some administration.

Access is required by many staff but accessing personal information must be justifiable by those only in the patient's circle of care, he said.

“This is a serious breach of trust and we treat it as such,” Paluzzi said.

He said a handful of similar cases have occurred since 2008 and have resulted in employee terminations.

“We continue to perform random audits and we educate our employees about our policies the the repercussions of not following those polices.”

The Sault Area Hospital is not the first hospital to experience breach of privacy issues.

Lawyers representing the hospital had unsuccessfully attempted to toss out the lawsuit last fall but the courts ruled the claim has merit and can be tested in the courts.

In that case, the Peterborough hospital fired seven employees for snooping at the records when they were not entitled to do so.

Lawyer Michael Crystal, of the Ottawa-based law firm Michael Crystal and Associates, who is representing the plaintiffs in the Peterborough case, said he's already been contacted by a Sault Ste. Marie resident about the local situation.

“I have been contacted and I have a representative plaintiff,” Crystal said in a telephone interview. “My intention is to move forward with a class action.”

Crystal said his client is distraught about the disclosure of patient records.

He said that at this time, he cannot identify his client or the reason for hospitalization.

“I can only say that patients have had their privacy invaded and they can't understand how this happened. My job now is to speak to others in Sault Ste. Marie and do my due diligence,” he said.

Crystal said the statute of limitations is not an issue in the case and he will file an initial state of claim with a representative plaintiff in due course.

A representative plaintiff is one person who has enough of the common elements as other potential plaintiffs in the a class action lawsuit.

In the meantime, he has had some brief contact with a few other individuals in Sault Ste. Marie who also received letters from the hospital explaining the breach and plans on visiting Sault Ste. Marie in the future to conduct more interviews.

Crystal said that while the hospital may have limited ability to determine if the medical records were copied or downloaded, they wouldn't be able to know if the information was disseminated elsewhere.

“I'm very interested in this and will make myself immediately available to anyone affected” by the breached records, he said.